# US Company, EU Prospects: Does GDPR Apply to Your Cold Email?

> Yes. GDPR covers US companies emailing people in the EU, but each country's email law decides if you can send. 70% of EU GDP needs consent first.

Nov 11, 2026 · Cristian Frunze · 12 min · Guide

Tags: does gdpr apply to us companies cold email, GDPR cold email, B2B cold email Europe, GDPR legitimate interest, GDPR EU representative, ePrivacy B2B email rules, cold email compliance

![A founder with envelopes stands on his lowered half of a drawbridge; the other half stays up until the woman across decides to lower it.](/images/blog/gdpr-cold-email-us-companies-cover.webp)

In May 2021 the Dutch privacy regulator fined Locatefamily.com €525,000. The fine wasn't for spam. It was for having no representative in the EU.

**Yes, in most cases. GDPR covers a US company that cold emails named people in the EU. But GDPR alone doesn't decide whether you can hit send. Each country's email law does, and countries holding 70% of the EU economy require consent first, even for business contacts.**

This is general information, not legal advice.

Most guides stop at "GDPR applies, use legitimate interest." That's half the answer. GDPR governs how you handle someone's data. A separate law, the [ePrivacy Directive](https://eur-lex.europa.eu/eli/dir/2002/58/oj), decides whether you may send a marketing email at all. Its consent rule covers individuals, and Article 13(5) lets each country decide how to protect companies.

So I sorted all 27 EU countries into three groups, using their statutes, regulator guidance and DLA Piper's country guides. Then I weighted each group with Eurostat data.

- **Consent first.** 13 countries, with 70% of EU GDP, 75% of EU companies with 10+ employees and 70% of the population.
- **Opt-out allowed.** France, Ireland, Sweden, Portugal and Finland, with 25% of GDP. France alone is nearly two thirds of that.
- **Unclear.** 9 countries, mostly small, with 4.5% of GDP.

Count companies and the gap gets wider. For every company with 10+ staff in an opt-out country, there are four in a consent-first one. Germany alone has about 1.5 times as many as all five opt-out countries combined.

For a US company, the real question isn't "does GDPR apply?" It's "which country is this person in?"

## When does GDPR apply to a US company?

GDPR applies to a company with no EU office when it offers goods or services to people who are in the EU, or monitors their behavior there. That's [Article 3(2)](https://gdpr-info.eu/art-3-gdpr/). The European Data Protection Board, which writes the official guidance, names "marketing and advertisement campaigns directed at an EU country audience" as a sign of targeting in its [Guidelines 3/2018](https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf). A sequence written for German CFOs is about as directed as it gets.

Three details trip people up.

- **Location, not citizenship.** The Board says the rule "is not limited by the citizenship, residence or other type of legal status" of the person. An American working in Berlin is covered. A German working in Austin isn't, at least under this rule.
- **Work emails are personal data.** jane.doe@company.de identifies Jane. Selling B2B doesn't take you out of GDPR.
- **GDPR protects people, not companies.** [Recital 14](https://gdpr-info.eu/recitals/no-14/) leaves legal persons out. An email to info@company.de with no name attached is mostly outside GDPR, though national email laws can still cover it.

Open tracking can add a second hook. The Board lists "online tracking through the use of cookies or other tracking techniques" as a kind of monitoring, though it says the purpose matters. Its [Guidelines 2/2023](https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf) also bring email tracking pixels under the EU cookie rule, and in April 2026 France's CNIL published a [recommendation](https://www.cnil.fr/fr/recommandation-pixel-suivi-courriels) on when a pixel needs consent. It's one more reason we [turned off open tracking on cold email](https://ken.so/blog/should-you-track-email-opens-on-cold-email-we-turned-it-off).

## Is legitimate interest enough to cold email someone in the EU?

Legitimate interest is the GDPR legal basis most cold emailers rely on, and it can work. [Recital 47](https://gdpr-info.eu/recitals/no-47/) says direct marketing "may be regarded as carried out for a legitimate interest." In October 2024 the EU Court of Justice confirmed in [case C-621/22](https://curia.europa.eu/juris/liste.jsf?num=C-621/22) that a purely commercial interest can qualify.

"May" carries a lot of weight in that sentence. Paragraph 110 of the Board's [draft guidelines on legitimate interest](https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf), still the consultation version when I checked in October 2026, says Recital 47 "does not mean that direct marketing always constitutes a legitimate interest." You still have to pass a balancing test. Is the email about the person's job? Would they reasonably expect it? Can they stop it easily?

The bigger catch sits in paragraph 117. National email laws "may occasionally impose consent requirements that go beyond" the EU baseline, and the Board's example is "direct marketing towards professionals." Where a country's law requires consent, legitimate interest can't stand in for it.

A November 2025 ruling points the same way. In [case C-654/23](https://curia.europa.eu/juris/liste.jsf?num=C-654/23), Inteligo Media, the Court said a company that meets the ePrivacy email rule needs no separate GDPR legal basis. The facts involved a news site's own free account holders, so its reach is debated. Either way, the country's email law is the gate.

## Which EU countries let you cold email business contacts without consent?

Five, clearly. Nine more are unclear. Here's every EU country, sized by its share of the EU economy and colored by its answer to one question. Can you email a named person at their work address, about their job, with no prior relationship and no prior consent?

![70% of EU GDP sits in countries that need consent for B2B cold email](/images/blog/gdpr-cold-email-us-companies-1.svg)

*Source: Kenso analysis of national laws, regulator guidance and DLA Piper country guides, checked October 2026. GDP from Eurostat (nama_10_gdp, 2025). n = 27 countries.*

The 12 largest economies make up 89% of EU GDP. Here's how each one answers, checked October 2026:

| Country | Named work contact without consent? | What the rule says | Source |
|---|---|---|---|
| Germany | No | Ad email needs the recipient's prior express consent, business or not | [UWG §7](https://www.gesetze-im-internet.de/uwg_2004/__7.html) |
| France | Yes, with conditions | Must fit the person's job, say where you got the address and offer an opt-out | [CNIL](https://www.cnil.fr/fr/communication-electronique-quelles-regles) |
| Italy | No | Consent from the "contraente," which covers companies too | [Garante 2013 guidelines](https://www.garanteprivacy.it/home/docweb/-/docweb-display/print/2542348) |
| Spain | No | Ad email must be requested or expressly authorized | [LSSI art. 21](https://www.boe.es/buscar/act.php?id=BOE-A-2002-13758) |
| Netherlands | No | Consent, businesses included, unless they published the address to receive offers | [Telecommunicatiewet 11.7](https://wetten.overheid.nl/jci1.3:c:BWBR0009950&hoofdstuk=11&artikel=11.7) |
| Poland | No | Consent from any subscriber or end user, companies included. In force since November 2024 | [Electronic Communications Law](https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20240001221) |
| Belgium | No | Consent. Opt-out only for impersonal company addresses like info@ | [APD Recommendation 01/2020](https://www.autoriteprotectiondonnees.be/publications/recommandation-n-01-2020.pdf) |
| Ireland | Yes | Allowed to an address used mainly for work, if the email relates only to that work | [S.I. 336/2011, reg. 13(2)](https://www.irishstatutebook.ie/eli/2011/si/336/made/en/print) |
| Sweden | Yes, for companies | Consent for individuals, opt-out for companies. Sole traders count as individuals | [Marketing Act §19-20](https://www.riksdagen.se/sv/dokument-och-lagar/dokument/svensk-forfattningssamling/marknadsforingslag-2008486_sfs-2008-486/) |
| Austria | No | Consent for marketing email to any recipient | [TKG 2021 §174](https://www.ris.bka.gv.at/eli/bgbl/i/2021/190/P174/NOR40238632) |
| Denmark | No | Consent, businesses included | [Consumer Ombudsman](https://forbrugerombudsmanden.dk/media/02odpcge/hvorn%C3%A5-m%C3%A5-erhvervsdrivende-henvende-sig_2.pdf) |
| Romania | No | Express prior consent, extended to companies | [DLA Piper](https://www.dlapiperdataprotection.com/index.html?t=electronic-marketing&c=RO) |

Of the other 15, Portugal and Finland lean opt-out. Czechia, Greece, Lithuania and Malta need consent. Slovakia, Bulgaria, Croatia, Luxembourg, Slovenia, Latvia, Estonia and Cyprus are unclear, because the sources conflict or the exception only covers generic company addresses.

Hungary was the hardest call. Its [advertising law](https://njt.jog.gov.hu/jogszabaly/2008-48-00-00) requires consent only when the ad goes to an individual. Sweden's law has the same shape, but Swedish legal advice, like this [Lawline answer](https://lawline.se/answers/kravs-samtycke-for-att-skicka-e-post-i-marknadsforingssyfte-till-person-pa-annat-foretag), treats an address the employer controls as the company's. I found nothing like that for Hungary, so it goes in the unclear group.

Every line on this map has some judgment in it. Whether a named employee counts as "the company" in Sweden and Portugal is less settled, and vendor guides draw the lines differently. [lemlist's GDPR guide](https://help.lemlist.com/en/articles/10213662-understand-gdpr-essentials), for example, puts Hungary, Croatia, Estonia, Latvia and Slovenia in its opt-out group. So I stress-tested the result, including with lemlist's grouping in place of mine.

![However you count it, opt-out B2B cold email covers at most 30% of the EU](/images/blog/gdpr-cold-email-us-companies-2.svg)

*Source: Kenso classification and lemlist's GDPR guide, both checked October 2026. Eurostat GDP (2025), enterprises with 10+ persons employed (2023), population (2025). n = 27 countries.*

The finding barely moves. **However you count it, the countries that allow opt-out B2B cold email hold at most 30% of the EU economy.** Consent-first countries stay at 70% of GDP even if every unclear country turns out to allow opt-out. Use lemlist's grouping and it's 72%. Count companies instead of euros and it's 75%.

## What does GDPR require in your first cold email?

GDPR requires the first cold email to tell the person who you are, why you have their data and how to stop you. When the address came from somewhere other than the person, [Article 14](https://gdpr-info.eu/art-14-gdpr/) applies, and Article 14(3)(b) puts the deadline "at the latest at the time of the first communication." The notice includes your identity, your EU representative's contact details, the purpose, your legitimate interest, and "from which source the personal data originate."

There's a second clock most guides miss. Article 14(3)(a) also caps the wait at one month after you get the data. The EU's transparency guidance, [WP260](https://ec.europa.eu/newsroom/article29/redirection/document/51025), says the first-email rule can shorten that month but never extend it. Buy a list in March, send the first email in May, and you're already late. Build EU lists close to the day you send.

The right to object gets its own rule. [Article 21(4)](https://gdpr-info.eu/art-21-gdpr/) says you must flag it at the first communication, "clearly and separately from any other information."

Poland shows regulators mean it. In 2019 its regulator fined Bisnode just over PLN 943,000. Bisnode had built a database from public business registers but only told the people it had email addresses for. A lower court annulled the fine because the order also covered people who no longer ran a business. In September 2023 Poland's top administrative court still [sided with the regulator on the core point](https://uodo.gov.pl/en/553/1572). Data from public registers needs a notice too.

You don't have to paste a privacy policy into a cold email. WP260 supports layered notices, with the key facts up front and a link for the rest. A short footer with a link is a common way to do it.

> You're getting this because you run finance at [Company], and [Product] is built for that job. We found your work email on [source]. [Your company, address] is responsible for your data. Our EU representative is [name, address]. Full details: [privacy link].
>
> Don't want to hear from us? Reply "no" and we won't email you again.

That "source" line means you need to know where your vendor's data comes from. A [B2B email finder](https://ken.so/blog/b2b-email-finder) that can't tell you leaves the line blank.

## Does a US company need an EU representative for cold email?

Probably, if you email EU contacts regularly. [Article 27](https://gdpr-info.eu/art-27-gdpr/) requires companies covered by Article 3(2) to appoint one in writing. The exemption is narrow. The processing has to be "occasional," which the Board reads as irregular and outside the normal course of business, and it also has to be unlikely to put people at risk. An ongoing outbound program into Europe doesn't fit.

The cost gap is wild. Prighter, one provider, lists EU GDPR representation at €420 to €4,752 a year before VAT on its [pricing page](https://prighter.com/pricing), checked October 2026. Locatefamily's [€525,000 fine](https://www.autoriteitpersoonsgegevens.nl/nl/nieuws/boete-van-525000-euro-voor-locatefamilycom) would pay for 110 years of the top tier.

Having no EU office doesn't put you out of reach either. When the Dutch regulator fined Clearview AI €30.5 million in 2024, it called Clearview "an American company without an establishment in Europe" and said it was looking into whether the [directors could be held personally responsible](https://www.autoriteitpersoonsgegevens.nl/en/current/dutch-dpa-imposes-a-fine-on-clearview-because-of-illegal-data-collection-for-facial-recognition).

## What happens when an EU prospect objects?

An objection to direct marketing is final. Once someone objects, [Article 21(3)](https://gdpr-info.eu/art-21-gdpr/) says their data "shall no longer be processed for such purposes." There's no balancing test and no "one more angle."

"Remove me," "stop" and an unsubscribe click all count. Put the address on a suppression list every tool checks. Our guide to [handling cold email replies](https://ken.so/blog/how-to-handle-cold-email-replies) covers sorting these on arrival, and the [opt-out rules guide](https://ken.so/blog/cold-email-unsubscribe-requirements) compares deadlines across CAN-SPAM, GDPR and CASL.

## What should you check before your first EU send?

1. **Tag every contact with a country.** Use the person's location over the company's headquarters when you have it. If you can't say where someone is, you can't say which law applies, so treat a blank country as the strictest country on your list. A missing field isn't a loophole.
2. **Check that country's rule.** Where it's consent first, keep named people out of the sequence.
3. **Write about their job.** Relevance drives the legitimate interest test and the French and Irish exceptions.
4. **Build the list close to send day.** The notice is due within a month of getting the data, even if you haven't emailed yet.
5. **Put the Article 14 notice in email one.** Who you are, where you got the address, why you're writing, a privacy link, and objecting on its own line.
6. **Make objecting one step.** A reply of "no" is enough. Suppress across every tool.
7. **Appoint an EU representative** if Europe is a regular market.
8. **Write a short legitimate interest assessment** and keep it on file.
9. **Decide on open tracking.** Pixels pull in the cookie rules and give you shaky data anyway.

## Frequently asked questions

### Does CAN-SPAM compliance cover emails to Europe?

No. CAN-SPAM is a US opt-out law. It doesn't meet GDPR's notice duties or a European country's consent rule.

### Can I email info@ addresses instead of named people?

Sometimes. An address with no person behind it is mostly outside GDPR, and Belgium explicitly allows opt-out marketing to impersonal company addresses. Germany's rule covers any recipient, so info@ doesn't help there.

### Does any of this cover the UK?

No. The UK left the EU and runs its own versions of both laws, the UK GDPR and PECR. The UK regulator, the ICO, says you can email "any corporate body" without consent if you say who you are and offer an opt-out, but [sole traders and some partnerships count as individuals](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/electronic-and-telephone-marketing/electronic-mail-marketing/).

### How big are GDPR fines?

[Article 83](https://gdpr-info.eu/art-83-gdpr/) sets a ceiling of €20 million or 4% of worldwide annual turnover, whichever is higher, for breaking the legal basis, notice and objection rules. A missing EU representative falls in the lower tier, €10 million or 2%. The cases in this article were far smaller, like Locatefamily's €525,000. National email laws carry their own penalties.

### Is a new EU law about to change these rules?

Not soon. The Commission withdrew the proposed ePrivacy Regulation, confirmed in the Official Journal as [C/2025/5423](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:C_202505423) on October 6, 2025. Its Digital Omnibus proposal from November 2025 would change parts of GDPR and the cookie rules. When I checked in October 2026, the [Parliament's procedure file](https://oeil.europarl.europa.eu/oeil/en/procedure-file?reference=2025/0360%28COD%29) showed no adopted position from Parliament or the Council. The country email rules above stay in force.

## The short version

GDPR follows your prospects into the EU, but the country they sit in decides whether you can email them at all. Across 70% of the EU economy, a named person has to say yes first. Kenso runs cold email and LinkedIn outreach for B2B companies, done for you, on infrastructure we own, and a human approves every campaign before the first email goes out. If you want to see that on your own market, [your first campaign is free](https://ken.so/free-campaign).